policy-application-checker

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:10 AM UTC
• Version: 1.0.0

Overview

This appears to be a benign local planning skill for turning user-provided policy or application materials into checklists, with a small overwrite caveat for its helper script.

Before installing, be comfortable with the agent session processing the policy, application, and applicant-profile details you provide. Review generated checklists and timelines before relying on them, and use a deliberate output filename because the helper script can overwrite an existing file at --out.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code only converts a pre-structured JSON requirements list into a Markdown checklist. This partially aligns with the checklist portion of the description, but it does not implement the broader declared behavior of reading policies, application requirements, and forms, nor does it create a risk list or a submission plan. The actual functionality is narrower and materially less capable than described.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are generic checklist and application-related terms that can match ordinary user requests outside the intended skill boundary. This can cause over-broad activation or routing to this skill when another workflow would be more appropriate, increasing the chance of unintended data handling or confusing outputs, though the skill itself is administrative rather than high-risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents the operative skill instructions entirely in Chinese, including objectives, checks, manual validation, and pass criteria. Because there is no opt-in, alternative language option, or justification that the skill is region-specific, it appears to impose a specific language/locale contrary to the language-choice policy.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The document presents core usage guidance and trigger examples partly in Chinese while other parts are in English, but it does not state whether the skill supports multiple languages or let users choose their preferred language. This can be read as a locale/language constraint that is not explicitly justified or offered as opt-in.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This code performs a file write to the path in --out and will overwrite existing content, but there is no pre-action confirmation, warning comment, or explanatory docstring disclosing that behavior. The only user-facing message appears after the write has already occurred.

Static analysis

No suspicious patterns detected.